Redundancy System Update

Redundancy System Update provides a way to perform firmware updates in the secondary control chassis while the primary control chassis is controlling outputs. However, during this time, redundancy is disabled in that the partner is unable to resume control on a primary failure. The partner is a module in a chassis that is in the same slot position as a module in the corresponding chassis. A module in the primary chassis can have a partner in the secondary chassis, and likewise, a module in the secondary chassis can have a partner in the primary chassis.
After the firmware update of modules in the secondary control chassis and recompiled application programs finish downloading to the updated secondary controller, lock the redundancy system and switch control to the secondary control chassis. No outputs or data of the highest priority task or controller-scoped tags change to an earlier state and no I/O connections are dropped. One particular difference between a Locked Switchover and a normal one is that only you can initiate a Locked Switchover. It is not initiated by a failure of the primary control chassis.
To perform a Redundancy System Update, you must first disable auto-qualification and disqualify the secondary control chassis. Once the secondary control chassis is disqualified, you can then upgrade the firmware of modules in the secondary chassis, upload the application program from the primary, convert it to the newer version, and download it to the secondary. The redundancy system is then placed in a Locked state, which will prevent application changes on both the primary and secondary controllers. This Locked state remains until you perform either a Locked Switchover or you cancel the Locked state.
As part of entering the Locked state, the secondary control chassis goes through a verification process to ensure that a switchover to the updated secondary control chassis can be performed. Once the redundancy system is locked, you can initiate a switchover from the locked primary control chassis to the secondary control chassis.
IMPORTANT:
  • You cannot download to a controller Locked for update.
  • You cannot download firmware updates to a primary control chassis that is in the Locked state.
  • You cannot download firmware updates from a connection to a synchronized secondary or secondary that is in the Locked state.
Using the Keyswitch in Primary Processor Mode and Secondary Processor Mode
The mode of a secondary control system is limited based upon its module redundancy status, that is, synchronized, disqualified, or locked. The following list summarizes these restrictions.
  • The mode of a disqualified, synchronizing, or locking secondary control system can never be RUN or TEST. Therefore, the
    Logix Designer
     application disables remote mode changes to a disqualified, synchronizing, or locking secondary system.
  • The mode of a disqualified, synchronizing, or locking secondary system can never be RUN, regardless of the secondary’s keyswitch position. Therefore, the
    Logix Designer
     application indicates the mode of a disqualified, synchronizing, or locking secondary as PROGRAM (or FAULT), even when the keyswitch is moved to RUN.
  • The mode of a synchronized or locked secondary system whose keyswitch is in the REMOTE position tracks the mode of its primary partner. Therefore, the
    Logix Designer
     application disables remote mode changes to a synchronized or locked secondary.
  • The mode of a synchronized or locked secondary system cannot be RUN if the primary system is in PROGRAM or TEST, regardless of the secondary’s keyswitch position. Therefore, the
    Logix Designer
     application indicates the mode of a synchronized or locked secondary as PROGRAM/TEST, even when the keyswitch is moved to RUN.
    Note that if a switchover occurs while under this condition, the secondary processor does not execute, but instead enters fault mode.
  • If a secondary’s keyswitch is in PROGRAM mode, it does not track the primary’s mode.
  • If a switchover occurs while a synchronized or locked secondary has its keyswitch in PROGRAM mode, the new primary goes into PROGRAM mode, regardless of the mode of the old primary.
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.
Normal